Ensure the Sudo Timeout Period Is Set to Zero

AltaNivel 1Automatizadamacos

Descripción

The sudo command allows the user to run programs as the root user. Working as the root user allows the user an extremely high level of configurability within the system. This control, along with the control to use a separate timestamp for each tty, limits the window where an unauthorized user, process, or attacker could utilize legitimate credentials that are valid for longer than required. Audit: Requires a 0.0 minute sudo timestamp timeout and /etc/sudoers.d owned by root:wheel. Run as root.

Cómo se verifica

Método de auditoría: Comando de shell

shell

v=$(/usr/bin/sudo -V 2>/dev/null) || exit 1
c=$(printf '%s\n' "$v" | /usr/bin/grep -c "Authentication timestamp timeout: 0.0 minutes")
o=$(/usr/bin/stat -f '%Su:%Sg' /etc/sudoers.d 2>/dev/null)
if [ "$c" -ge 1 ] && [ "$o" = root:wheel ]; then echo compliant; else echo "timeout-zero=$c owner=$o"; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Terminal: sudo /usr/sbin/visudo -f /etc/sudoers.d/<configuration file name> ; sudo /usr/sbin/chown -R root:wheel /etc/sudoers.d/.

Propiedades

Sistemas operativos: macos-15
Etiquetas: macossystem-access
Referencia: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 5.4 Ensure the Sudo Timeout Period Is Set to Zero

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target macos